To: 


Of: 
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Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


EB Associates Group Limited 


585a Fulham Road, 
London 
SW6 5UA 


The Information Commissioner (“the Commissioner”) has decided to 
issue EB Associates Group Limited (“EBAG”) with an enforcement 
notice under section 40 of the Data Protection Act 1998 (“DPA”). The 
notice is being issued because of a serious contravention of regulation 
21B of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003. 


This notice explains the Commissioner's decision. 


Legal framework 


EBAG, whose registered office is given above (Companies House 
Registration Number: 08093318) is the organisation stated in this 
notice to have instigated the use of a public electronic communications 
service for the purpose of making unsolicited calls for the purposes of 
direct marketing in relation to occupational pension schemes or 


personal pension schemes contrary to regulation 21B of PECR. 
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Regulation 21B paragraph (1) of PECR provides that: 


“(1) A person must not use, or instigate the use of, a public electronic 


communications service to make unsolicited calls to an individual 


for the purpose of direct marketing in relation to occupational 


pension schemes or personal pension schemes, except where 


paragraph (2) or (3) applies.” 


Regulation 21B paragraphs (2), (3), and (4) provide that: 


“(2) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; and 


the called line is that of an individual who has previously 
notified the caller that for the time being the individual 
consents to such calls being made by the caller on that 


line. 


(3) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; 


the recipient of the call has an existing client relationship 
with the caller on the line and the relationship is such that 
the recipient might reasonably envisage receiving 
unsolicited calls for the purpose of direct marketing in 
relation to occupational pension schemes or personal 


pension schemes; and 
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(c) the recipient of the call has been given a simple means of 


refusing (free of charge except for the costs of the 


transmission of the refusal) the use of the recipient’s 


contact details for the purpose of such direct marketing, at 


the time that the details were initially collected and, where 


the recipient did not initially refuse the use of the details, 


at the time of each subsequent communication. 


(4) A subscriber must not permit the subscriber’s line to be used in 


contravention of paragraph (1)”. 


6. Regulation 21B paragraph 5 materially states that: 


"(5) In this regulation— 


(a) “authorised person” has the meaning given in section 31 of 
the Financial Services and Markets Act 2000; 


(b) “direct marketing in relation to occupational pension 


schemes or personal pension schemes” includes— 


(i) 


(ii) 


(iii) 


the marketing of a product or service to be 
acquired using funds held, or previously held, 
in an occupational pension scheme or a 


personal pension scheme, 


the offer of any advice or other service that 
promotes, or promotes the consideration of, 
the withdrawal or transfer of funds from an 
occupational pension scheme or a personal 


pension scheme, and 


the offer of any advice or other service to 


enable the assessment of the performance of 
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an occupational pension scheme or a personal 


pension scheme (including its performance in 


comparison with other forms of investment); 


(c) “existing client relationship” does not include a relationship 
established at the instigation of the caller primarily for the 


purpose of avoiding the restriction in paragraph (1); and 


(d) “occupational pension scheme” and “personal pension 
scheme” have the meanings given in section 1(1) of the 


Pension Schemes Act 1993.” 


Section 122(5) of the Data Protection Act 2018 (“DPA18”) defines 
direct marketing as “the communication (by whatever means) of 
advertising or marketing material which is directed to particular 
individuals”. This definition also applies for the purposes of PECR (see 
regulation 2(2) PECR and paragraphs 430 & 432(6) to Schedule 19 of 
the DPA18). 


Prior to 29 March 2019, the European Directive 95/46/EC defined 
‘consent’ as “any freely given specific and informed indication of his 
wishes by which the data subject signifies his agreement to personal 


data relating to him being processed”. 


From 29 March 2019 until 1 January 2021, consent in PECR was 
defined by reference to the concept of consent in Regulation 2016/679 
(“the GDPR”): regulation 8(2) of the Data Protection, Privacy and 
Electronic Communications (Amendments etc) (EU Exit) Regulations 
2019. Article 4(11) of the GDPR sets out the following definition: 
“‘consent’ of the data subject means any freely given, specific, 
informed and unambiguous indication of the data subject's wishes by 


which he or she, by a statement or by a clear affirmative action, 
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signifies agreement to the processing of personal data relating to him 


or her”. 


Recital 32 of the GDPR materially states that "When the processing has 
multiple purposes, consent should be given for all of them”. Recital 42 
materially provides that “For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 
processing operations despite it being appropriate in the individual 


case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services.” 


The DPA contains enforcement provisions at Part V which are 
exercisable by the Commissioner. Those provisions are modified and 
extended for the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, she may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 
refrain from taking after such time as may be so specified, such steps 


as are so specified. 
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PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 


overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


The contravention 


The Commissioner finds that EBAG has contravened regulation 21B of 
PECR. 


The Commissioner finds that the contravention was as follows: 


The Privacy and Electronic Communications (Amendment) (No. 2) 
Regulations 2018, which came into force on 9 January 2019, amended 
PECR to insert Regulation 21B which restricts calls made for the 
purposes of direct marketing in relation to occupational pension 


schemes or personal pension schemes. 


The Commissioner is satisfied that EBAG positively encouraged its IARs 
to make calls on its behalf as evidenced by them being paid a fixed fee 
of between £300.00 and £750.00 for each referral made to it. The 
marketing campaign was initiated by EBAG; Ei and were 
commissioned by EBAG to engage in direct marketing in order to 
generate leads. The very fact that EBAG conducted (on its case) some 
due diligence on the IARs and insisted on high standards of regulatory 
compliance shows that it was consciously engaging the IARs to carry 
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out direct marketing - this is also borne out by EBAG’s disclosed 
communications with ij and J expressly about direct marketing 
and the (then impending) cold-calling ban. Accordingly, the 
Commissioner takes the view that the calls made by the IARs over the 


period of contravention were made at the instigation of EBAG. 


The calls instigated by EBAG constitute ‘direct marketing in relation to 
occupational pension schemes or personal pension schemes’ within the 
definition of regulation 21B(5)(b)[iii] PECR. Specifically, Regulation 
21B(5)(b)[iii] includes “the offer of any advice or other service to 
enable the assessment of the performance of an occupational pension 
scheme or a personal pension scheme (including its performance in 


comparison with other forms of investment)”. 


To engage in such calls it is a requirement of regulation 21B PECR that 
the caller be an ‘authorised person or a person who is the trustee or 
manager of an occupational pension scheme or a personal pension 


scheme’. 


Regulation 21B(5)(a) PECR states that “authorised person” has the 
meaning given in Section 31 of the Financial Services and Markets Act 
2000 (“FSMA”). Section 31(1) FSMA lists the categories of persons 


who would constitute “authorised persons”. 


The calls carried out on EBAG’s behalf were carried out by IARs which 
are not included in the list of categories of ‘authorised persons’ at 
Section 31(1) FSMA.. 


However, the Commissioner accepts that EBAG would meet the 
necessary criteria to be considered an ‘authorised person’ as defined by 
section 31(1) FSMA, and that in the circumstances, whilst it instigated 


calls to be carried out by non-authorised entities, it would be capable 
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of satisfying the requirement of Regulation 21B(2)(a) and/or 
21B(3)(a). 


26. The Commissioner is not however satisfied that EBAG or the IARs 
making the calls had the valid consent of those who were called, or 
that they had an existing customer relationship with them, as required 
by regulation 21B(2)(b) and 21B(3)(b). 


27. During the course of the Commissioner’s parallel investigations into 
EBAG’s IARs it was discovered that PB would obtain data from B = 
matching the information provided by EBAG - which used three sites to 
collect the data used for its calls: 
it ots os an Ea and ii. The investigation 
into ll discovered that it too obtained data via websites, specifically: 
E 

ee o o The Commissioner notes a discrepancy 
in that EBAG stated that obtained its data via o o whereas 
the Commissioner's investigation into J found that it obtained data 
via ats In any event, the Commissioner notes from the 
‘due diligence’ form which EBAG provided in relation to i that its 
‘example of website used to get opt in data’ cites 
Rn aS 2 Source website and so is satisfied 
that the data is likely to have originated from the same sources as 


disclosed to the Commissioner by i. 


28. For consent to be valid it is required to be “freely given”, by which it 


follows that if consent to marketing is a condition of subscribing to a 


' Although it is understood that data obtained via this website was not used by ll following the introduction of 
Regulation 21B PECR. 
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service, the organisation will have to demonstrate how the consent can 


be said to have been given freely. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 


organisation, that will be sending it. 


Consent will not be “informed” if individuals do not understand what 
they are consenting to. Organisations should therefore always ensure 
that the language used is clear, easy to understand, and not hidden 
away in a privacy policy or small print. Consent will not be valid if 
individuals are asked to agree to receive marketing from “similar 


Wem A 


organisations”, “partners”, “selected third parties” or other similar 


generic description. 


In this instance, EBAG instigated direct marketing calls to individuals 
who had provided their details via six competition/offer websites. 


EBAG has not provided evidence of specific consent for the calls that it 
instigated. The Commissioner has however sought to review the sites 
from which consent would have been obtained by its IARs. She takes 


the view that the point at which consent was obtained via 


N -i 
PY it is clear that there is an apparent option for 


individuals to select the means by which they may wish to receive 
direct marketing. However, before being able to proceed, individuals 
are required to agree to the relevant website’s privacy policy, with the 
privacy policies themselves dictating the way marketing will be sent, 
apparently regardless of any preferences selected by the individual. 
Furthermore, individuals are denied the ability to select which of the 
listed sectors or organisations they may wish to receive that marketing 


from, which implies that the individual must agree to receive marketing 
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from all. In this way, any consent relied upon by EBAG for the calls 
made by E cannot be said to have been appropriately specific or freely 


given. 


Looking at the competitions websites used by a, it is apparent that 
an individual cannot enter a competition without providing consent to 
marketing. There is no way for an individual to freely consent to 
receive a specific method of marketing or to receive marketing from 
individual third parties as listed. Accordingly, EBAG would be unable to 
evidence valid consent for the calls made to these individuals by its IAR 


in relation to pension schemes. 


The Commissioner has established that between 11 January 2019 and 
30 April 2019 there were 106,987 connected calls made by ij at the 
instigation of EBAG; with a further 16 calls being made (capable of 
being evidenced by complaints) between 2 February 2019 and 30 
September 2019 by PB at the instigation of EBAG. 


The Commissioner is therefore satisfied that, between 11 January 2019 
and 30 September 2019, EBAG instigated the use of a public electronic 
communications service for the purpose of making 107,003 unsolicited 
calls for the purposes of direct marketing in relation to occupational 
pension schemes or personal pension schemes contrary to regulation 
21B of PECR. 


The Commissioner has considered, as she is required to do under 
section 40(2) of the DPA (as extended and modified by PECR) when 
deciding whether to serve an Enforcement Notice, whether any 
contravention has caused or is likely to cause any person damage or 
distress. The Commissioner has decided that it is likely that damage or 
distress has been caused in this instance, not least since pension calls, 
in particular, can lead to high levels of financial detriment and/or 
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emotional stress. It is for this reason that the restriction on such calls 


was introduced. 


37. In view of the matters referred to above the Commissioner hereby 
gives notice that, in exercise of her powers under section 40 of the 
DPA, she requires EBAG to take the steps specified in Annex 1 of this 


Notice. 


Right of Appeal 


38. There is a right of appeal against this Notice to the First-tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. 


Information about appeals is set out in the attached Annex 2. 


Dated the 29t" day of November 2021. 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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TERMS OF THE ENFORCEMENT NOTICE 


EBAG shall within 30 days of the date of this notice: 


Neither use, nor instigate the use of, a public electronic 


communications service to make unsolicited calls to an individual for 


the purpose of direct marketing in relation to occupational pension 


schemes or personal pension schemes, except where: 


(a) 


(b) 


The caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; and 


the called line is that of an individual who has previously 
notified the caller that for the time being the individual 
consents to such calls being made by the caller on that 


line. 


Or where: 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme 


the recipient of the call has an existing client relationship 
with the caller and the relationship is such that the 
recipient might reasonably envisage receiving unsolicited 


calls for the purpose of direct marketing in relation to 
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occupational pension schemes or personal pension 


schemes; and 


the recipient of the call has been given a simple means of 
refusing (free of charge except for the costs of the 
transmission of the refusal) the use of the recipient’s 
contact details for the purpose of such direct marketing, at 
the time that the details were initially collected and, where 
the recipient did not initially refuse the use of the details, 


at the time of each subsequent communication. 
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ANNEX 2 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 
accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 
Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


e The notice of appeal should be served on the Tribunal within 28 


days of the date on which the enforcement notice was sent 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 


